Wireshark · Wireshark-dev: Re: [Wireshark-dev] Define dissector port

[Guy Harris <guy@xxxxxxxxxxxx>]

Hal Lander wrote:
> Is there a way to get a dissector to run on all ports?

A dissector that runs on all ports would have to be a heuristic 
dissector (otherwise, you wouldn't be able to dissect any TCP/UDP 
traffic except for traffic for your protocol).

So the way you'd do that would be to have your dissector be able to look 
at a packet and determine whether it's a packet for your protocol or 
not, and use a check for that sort in your dissector.  See 
doc/README.developer for information on how to make a heuristic 
dissector.  The name of the heuristic dissector table for TCP is "tcp", 
and the table for UDP is "udp".